providing Findit results for internal purpose:
Suspected CLs	No CL in the regression range changes the crashed files. The result is the blame information.

Author: mjs
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/f487f59a87e827ab8ec3544f0ac0749cc3b36d0c
Time: Fri Mar 31 11:24:53 2006
The CL last changed line 63 of file IntPoint.h, which is stack frame 0.

Author: nbarth@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/bbd54fe3e0634a2b780fe356e81b3dde1d60d5a1
Time: Fri Jul 26 02:35:40 2013
The CL last changed line 94 of file IntRect.h, which is stack frame 1.

Author: eseidel@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/f1eeeb96f96c370b242eb501a4e668647693e6aa
Time: Fri Dec 20 08:33:22 2013
The CL last changed line 1242 of file LocalDOMWindow.cpp, which is stack frame 2.

Suspected Project: chromium

Unable to find the culprit, requesting blink team to check and update the issue.

Regression range has no likely suspect; the least unlikely is the clang roll...

eae@ could you please help us here to find the culprit and feel free to assigned back if needed.Thanks in advance

Not a regression but should be easy to fix.

Removing Needs-triage label.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/47e39c323732b04b595f7a46a225b3cd7e768567

commit 47e39c323732b04b595f7a46a225b3cd7e768567
Author: eae <eae@chromium.org>
Date: Tue Aug 23 23:06:32 2016

Fix int overflow in window.moveBy

Fix an int overflow bug in window.moveBy by changing it to saturate when
performing addition though a new saturatedMove method on IntPoint, Rect.

BUG= 635799 
R=pdr@chromium.org

Review-Url: https://codereview.chromium.org/2264723002
Cr-Commit-Position: refs/heads/master@{#413885}

[modify] https://crrev.com/47e39c323732b04b595f7a46a225b3cd7e768567/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
[modify] https://crrev.com/47e39c323732b04b595f7a46a225b3cd7e768567/third_party/WebKit/Source/platform/geometry/IntPoint.h
[modify] https://crrev.com/47e39c323732b04b595f7a46a225b3cd7e768567/third_party/WebKit/Source/platform/geometry/IntRect.h

ClusterFuzz has detected this issue as fixed in range 413791:414128.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6036424619196416

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::IntPoint::move
  blink::LocalDOMWindow::moveBy
  blink::DOMWindowV8Internal::moveByMethodCallback
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=413791:414128

Minimized Testcase (0.11 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96uQgE-hw7wrJ2XpTee6kPM0CMenpg-ZOOd-JxZSmyzwbGt2iP6NtoLLactfUCsyMq4lE90ZeFQBCHqkxYeao3q3wQr4xCnGqpNfCcxxb4KjfzixxT4KQOcw25KXQspo1x1-Pfwncp2in4UG95ziUhoC8JE8Q?testcase_id=6036424619196416
<script>
    y = 47;
    x = 65428;
    window.moveTo(x, y);
    x = 2147483543;
    window.moveBy(x, y);
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot